General
- Target 2026-08-22_e70ac32bb837c8a6204a60a3794f6aae_coinminer_elex_revil
- Size 122KB
- Sample260822-17q76sgf33
- SHA256 16a893ebca922aa7cac02ec569529a0166c63a760122402a53cdb25f75ec8338
Malware Config
Extracted
-
sodinokibi
-
$2a$10$dfjpLrXuDytfF.kmYtQ1ROgsXjTJEe8EmQT65ftxlTpJtXPZrhsAq
-
7178
-
kamahouse.net
-
bridgeloanslenders.com
-
abitur-undwieweiter.de
-
live-your-life.jp
-
xn--rumung-bua.online
-
anteniti.com
-
marcuswhitten.site
-
ostheimer.at
-
joseconstela.com
-
deepsouthclothingcompany.com
-
dr-seleznev.com
-
ecpmedia.vn
-
aunexis.ch
-
anthonystreetrimming.com
-
pocket-opera.de
-
mooreslawngarden.com
-
osterberg.fi
-
extraordinaryoutdoors.com
-
kamienny-dywan24.pl
-
fitovitaforum.com
-
net
false
-
pid
$2a$10$dfjpLrXuDytfF.kmYtQ1ROgsXjTJEe8EmQT65ftxlTpJtXPZrhsAq
-
prc
avgadmsv
BackupUpdater
ocautoupds
synctime
thebat
excel
isqlplussvc
ccSetMgr
SPBBCSvc
Sage.NA.AT_AU.SysTray
lmibackupvssservice
CarboniteUI
powerpnt
BackupMaint
onenote
klnagent
sql
Rtvscan
xfssvccon
Smc
mspub
encsvc
LogmeInBackupService
kavfsscs
ccSvcHst
BackupExtender
NSCTOP
outlook
dbsnmp
mydesktopservice
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7178
-
svc
ssistelemetry
adsync
svc$
msseces
mbamservice
ssastelemetry
altaro
sbamsvc
ds_notifier
ntrtscan
ofcservice
code42service
macmnsvc
memtas
auservice
telemetryserver
tmccsf
psqlwge
sppsvc
viprepplsvc
azurea
ds_monitor
swi_filter
protectedstorage
mfemms
mfevtp
kaseyaagentendpoint
ltservice
dssvc
altiback
Extracted
-
C:\Users\52326500-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 52326500. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AA7FE5CA2869828A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/AA7FE5CA2869828A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: aJjdXpADY1ypDKoO2LF0Tcnp65ALHhxi+EVsZZmWWdImzadEupfen2E81D8KDTtu nC1PFODg3eFIRDjfN6RjyTp0oaYeyKH5WHYJ4uam5NXgZUUTIl6efUB7MvTam2DU O0F1F31wcouCh4+F9/lZWZrzqcvK63CbxxU65rj60GLLtm9RBuTjbmvJtSl9LU82 hlsLid4ACv3l8wi/GkuJNIiWaDPuZQZooVI0CdapxrZk04a+1gqtQ/78kBmFBaVX FzEmqDVIv0mvl42dRvUd/dtxznRVtK8dhj78X2ef/3xC2jfBcDgtdJfdSA74MMvs OjVL+02pCk4Aoq/5Ht3RKRHXAr7qgMqATp14L8P4s0rHxhrV055p5V8PVZ86Q1CL 06YCvHuq7OXsdfFi+cnusikiNlKUTbAmz1IG89JQiQsmfn5EenHjAb/nAx7cu5Rf LLz7IXqIiDNinaYyFBq4vu0AzxFa3vTCfqjiiJNcOfn+IjtzfRP20hO+1sqbA4p5 lhYsVnSLABKcCXP/laN6UWJpf/goVMYUjjMX5Q9a9wH4Ogv+3pt2wGj0jxtgyEkg O49fiGGZ1eg4L2CvZG/Pe79NmwwcsMUBj24FeUTzl2h7thcB2qByjNzcjasxJvC9 F3/QoTjAPGIjAFWOoG70Ia0hkp/3a8BfwJVaT835WeLXmK70YeEt9c3VCJkUw/YY bKaJSBlJVVbyjMJVVPLxtuEQ8FBcEhChQIlvTAn3GjF3V+4raZj4PZU7zBQkphb4 gZObzuQmOYyb9CyiKDrY9zBLWvpIdnHwo3ZI5LULeTmUuGfkr8bkNGEbXNKSsXfv MsU6v+RXTGylMneHqy7WdReiebJQEkHgtbbC7cIf5S0Uzq1N0wgbYyTUXY3clV1i x7R8W3ZDLKVLN3hxdWmkXyA1e7DqJTmj1GzxoKTX4xAewyDGqo1e3tuHmENP4vJ/ uUN7LlDralrUK2t16qBislkF1pC5V5FUsMlQsiiiI24txeaxG58/KKYbeMowTJBZ 80GuEgOQbY8tpzI9B/An1DHzzmTH5WsfEFMxLotODf03htaNG+F6H+oTni+8ZoP6 nAQM4RfmzTwX9GKQ2buVkpalOAWvM9A//1qXo47NyALdeexJSe8Q8QKBfW0yXnSr npJxqV+JAG0tlbFKulUXHfeWnHC/J0m94/ecs4Vpa7DPBVj02sTA2Yhw9TDFf0Yq uvIHAAyqMIbOP0XwH2rslKP95gPkTG0pL7oYv2AwLB+F/DC4tJRqfmC+TjOoTLo9 UMz4PMzH3srQfPYnQIiXxU4vaz5ky5fbMWfEOvGBETeykPRc+Vg+UcAwn9iU1Aro o7WL5p0PpVdLNX5KkwlU2cF+q+0LUl8NkhdiWUZTPNY= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AA7FE5CA2869828A
-
http://decoder.re/AA7FE5CA2869828A
Extracted
-
C:\Users\48ww1r0-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 48ww1r0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B1C6A758F6EA3B44 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/B1C6A758F6EA3B44 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: odtN9MIorXzZSZ+QYJPmLEjrOqFa+tXs2WqgmWKJ4/iLzmi/9frgStI4ELnnw891 aeXsw1J8SVHLJ6em7MDDwZSe+UqPCuMcm9Bu3qt8LGom6TNm2P9MT31UjDYiAuIo zmiP/xnXVBAIrobO7V1+j3+Kcp6+fjVUWrKMFEKeZKN4tUJZkA0Ric+8aUgqIlY0 7pbvMNtzZpvcNffh0Oqu/ZcZJ6McaVZDyOzZ4fG9bANvRVOgITG9Ner4S70StfhV ZOavpYiV/ueBQRlggxaB58qQjIiGovtNi4vvjnqoMODiFfxGhMB8tOf/Pl8PIkYn mrYVIPu8cwFcUq1MtfYIBD95vlgojZ6NI9zXHu0Z+Td/Skua9jcVi3/wviPcBPmr Isl73ah1iY5/TftDYFleQE3MObE0x8DJeLrJ96iMFwodGPysLbWCajAp4rbaYAvm 1JEzECRQOmtpT3UAd3mrdT5m4k9bLSifk88jIhwjPKsD4+2pVJhg4PREEO3j9FG/ X2EWxdKm4rhb3PXM21I+Exd2eB72qKoAW1IUI0JPHVYTRmYO7ecOX60UM68qVFk1 dvHyldulZHiLeFiB9aDrPuQW2/ofxGz0kH/Mu7rYzdBk+hmvK0ZcOQNyfQoTII4i 1SQUQ1RhwVb6vODSohcpgwaG+rEN31Nt5BFUCUtSagteRnUVbIAZvrJt3yP09XYe tQHCUlgpy/ioEFi3ADNmcxOzrFp6k3Rf0l/eaM+nu3YeyjiGsubwsBbO00BdqbgG eKF4Vo1FS/Pph8kaFycZhaj1AUeM5pIAr+Mk83P4rBhE2rpHqHmEluXPVfrTyiAE Nq45vNheWC5lRnbzVDjk18oQvI0ChjgBjkNEXuXvnw/6btay9Bd/I/DOzMckRToJ HwpqmAKboAGDZNeolPCayJJqDboeLS600oMfUknQUeZ72ZXfWNUNAMLTpgESWkvd qqnzkopFc5RFLjP9jk4UlvE4V7VkAZSnDPh6YxxAAhlj5PXVrWGxulMLKg0+ALTI nB3WWae4fkBO3/JNyDZvmOpf7Won0r4Jv9z/34a1L7ep21717pGc88iu5rC6+vi9 WvWc/LGbm9Oy/bXQSXTZ66Is/wtyg59rsT88Lk2ENRlwav787ubMeDpEcKenlS8o Rh0ZCS2DMPsh1p1KO0ZPUBhPC8c48GZLVaidebjRpJYbJXLIB4EN0G8f/jZ/kyrh /DoSf88jrwxgFbjgVfoMMIn2vvBDv4RzyGOe2+vJPIPEwVHMXl0eeSMIPuUgLylS G/4eg9+q1/Fc7bZCa9bzQhwECZD2G6mP7mqTXECeBJ48+5DNqZSecTOwtqfD8UzW PzYYMLY4E3AgEKGx/6cundds0jrubBrMPkrRVrtZ5mN/JZZsz3fl3aSYwsGxbBW7 sWI= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B1C6A758F6EA3B44
-
http://decoder.re/B1C6A758F6EA3B44
Targets
-
- Target 2026-08-22_e70ac32bb837c8a6204a60a3794f6aae_coinminer_elex_revil
- Size 122KB
- SHA256 16a893ebca922aa7cac02ec569529a0166c63a760122402a53cdb25f75ec8338
Score10/10-
Family: Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1